Single Sign On - pCloudy SSO
Single sign-on is an authentication system that allows a user to log in with a single ID and password to any of related, yet independent software systems.
SSO services allow users to use a set of login credentials (e.g., email and password) to access multiple applications. The service authenticates the end-user's credentials only once for all the applications according to the rights given to the user.
A very common example is Google’s SSO implementation of login for their products, such as Gmail, YouTube, and so on. Any user logged in to one of Google’s products is automatically logged in to their other products as well.Some common advantages of SSO:
- Removes the need for users to remember and manage multiple passwords.
- Simplifies user’s experience by allowing them to log in at one single access point and enjoy a seamless experience across multiple applications.
- Increases productivity significantly by reducing password-related support emails.
- Reduces phishing and thereby makes sure that users aren’t tricked into giving away sensitive information.
- Should be a registered user on the pCloudy platform
- The Profile of the user should be validated
- An Azure subscription (as we have taken Azure as an example here). Or as per user need, it can be okta, Azure
A) Configuration needed from Infra /ITPlease Note - We have taken Azure AD SSO as an example
Follow these steps to enable Azure AD SSO in the Azure portal.
- In the Azure portal, Create the app and select single sign-on (manage section).
- On the Select a single sign-on method page, select SAML.
- On the Set up single sign-on with SAML page, click the edit/pen icon for Basic SAML Configuration to edit the settings.
- Please ensure that the default checkbox as shown in below screenshot is checked
For Reply URL:
E.g. https://device.pcloudy.com/samlconsumer and paste it in Reply URL
For Logout URL: Paste log out URL in SAML configuration as shown in below screenshot.
Custom attributes need to be created in a special format. As shown in the below screenshot.
In the SAML Signing Certificate section, find Federation Metadata XML and click on the `Download . Open metadata.xml in some editor and copy Certificate which is required to fill the SSO form.
In the metadata.xml file Certificate section will look like in the format shown below
Note: The user needs to paste this section only in the SSO form (certificate field value).
Copy the Azure AD Identifier. This will be needed to add in the 'IdP issuer’ field in SSO form.
Go to the SAML Properties page and copy the User access URL. This will be needed to add in the 'IdP Single Sign On URL’ field in SSO form.
These are the configurations needed from Infra/IT. Once this is done, the user will need to convert a normal account to SSO.
B) Steps to migrate the user account to SSO
Step 1 - User needs to login into the pCloudy platform. After login, click on Profile. Go to setting and click on the SSO tab as shown in the below screenshot
Step 2 - Fill all required fields -Identity Provider, IdP Issuer, Display Name, Domain name, IdP Single Sign-On URL, and Certificate to Validate Signature. Click on “Save”
- IdP Identity Provider: An identity provider is “a trusted provider that lets you use single sign-on (SSO) to access another website. E.g. Azure
- IdP Issuer/ IdP Entity ID: This field corresponds to the “Idp Entity ID” field available in the SSO Configuration window. Here, you will need to paste the copied Azure AD Identifier.
- Domain name: E.g. sstsinc.com
- Display Name - E.g. pCloudy
- IdP Single Sign-On URL - This field corresponds to the “IdP Single Sign-On URL” field available in the SSO Configuration window. Here, you will need to paste the copied User access URL from the SAML Properties page
- Certificate to Validate Signature: this field corresponds to the "IdP certificate" available in the SSO Configuration window. Copy and paste the certificate accordingly.
Step 3 - Once the data is saved, a unique “Entity ID” is generated as shown in below screenshot.
Step 4 - User needs to inform their IT/Infra team to update the generated Entity ID in SSO configuration form Under SP Entity ID field. Refer to the below screenshot.
Once the whole process is complete, users can use one set of login credentials and access multiple applications.
Note: Application permission needs to be provided from the infra/IT team
End-user credentials get authenticated only once for all the applications according to the rights given to the user.